MCP servers as review context

CodeLotse can look up context on Model Context Protocol (MCP) servers your organisation runs or uses, such as an internal wiki, a ticket system or design documents, while it reviews a pull request. External context can explain why a change was made. It never counts as evidence: every finding must still be provable from the diff or the files of the repository.

Awaiting security sign-off. The feature is built but inert until the maintainer signs the threat analysis (mcp-context.md). Until then the web interface shows a notice, the API refuses changes and reviews never contact an MCP server.

Requirements

• The instance allows it: QUAVON_MCP_CONTEXT=allowed (default disabled; see the configuration reference). The air-gap profile keeps it off.
• The repository is private or internal. MCP context never runs on public repositories.
• Only remote servers over Streamable HTTP with an https:// URL. There is no local command or stdio support.

Register a server

Tenant admins open MCP servers in the organisation navigation (permission tenant:manage):

1. Register server: name, https URL (without user name, password, query or fragment) and the authentication: none, a bearer token or one custom header whose name starts with x-. Secrets are stored encrypted and shown only as a hint afterwards.
2. Confirm that search terms derived from pull requests are sent to this server.
3. Discover tools lists the tools of the server with their annotations. Tools with a nested or array input are marked "unsupported schema" and cannot be selected.
4. Select at most 20 tools and adjust the description the model sees (500 characters). CodeLotse fetches the tool list again when you save and stores each tool's definition with a fingerprint. Tools that the server does not mark as read-only, or marks as destructive, need an explicit confirmation.
5. Recent calls shows the last 50 calls per server: tool, status, sizes and duration. Arguments and results are never stored.

When a server changes a tool after approval, CodeLotse stops calling that tool, records the call as blocked and shows tool_changed as the last error. Discover again and save the selection to approve the new definition. Changing the URL asks for the confirmation that search terms are sent to the server again and resets the tool selection; a move to another host also needs the authentication again.

Self-hosted instances reach only public addresses by default. An instance operator can allow internal hosts with QUAVON_MCP_PRIVATE_HOSTS (comma-separated host names).

Use it in a repository

Repository maintainers open Policy → External context (MCP) (permission repo:manage):

• Mode: on or off (default off).
• MCP servers: up to five of the organisation's servers.
• Calls per review: 1 to 20, default 5.

The section follows the organisation defaults like every other section.

What happens during a review

• Only the step that looks for problems (the finder) may call the allowlisted tools, named mcp_<server>_<tool>. The step that verifies findings and the summary do not get them.
• CodeLotse sends short search terms only. Arguments with something that looks like a secret or an e-mail address are never sent.
• Results are treated as untrusted data: only text is kept, secrets are redacted (a result that contains a credential is dropped), each result is limited to 64 KiB (8,000 characters reach the model) and a review receives at most 256 KiB. Each request times out after 10 seconds.
• A server that cannot be reached is skipped and the review continues.
• The review run detail shows External context: N calls.

Data

Stored	Where	How long
Server name, URL, encrypted authentication, hint, tool definitions, acknowledgement	mcp_servers	Until a tenant admin deletes the server
Per call: tool, status, sizes, duration, a hash of the arguments	mcp_tool_calls	Tenant data retention
Number of calls, bytes and blocked calls per review	Review run statistics	With the review run

If the tenant enables debug prompt logs, the encrypted prompt logs also contain MCP results for the configured time.